The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
Invicti is an automated application security testing platform that identifies and reports vulnerabilities in web applications and APIs.
└──▷ HOW TO FIND IT
Enable AI-aided login recovery so scans can automatically recover from LSR playback failures without manual intervention.
📍In the Invicti console, open your scan policy or scan settings, locate the AI-aided Login setting, and enable it.
Adds AI-aided Login recovery: when an LSR playback fails during a scan, Invicti can now use AI to recover and complete authentication, reducing scan failures caused by login issues.
Increases the character limit for authentication values in IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. credentials from 1,024 to 4,096 characters, enabling long JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Bearer Tokens to be saved.
Cloudsmith is a cloud-native, universal package management platform that enables teams to securely host, manage, and distribute software artifacts across multiple formats.
Cloudsmith CLI 1.20.0 ships as a standalone binary, dropping the Python dependency, with a new bug bounty platform at bounties.cloudsmith.com.
New one-line installer, refreshed Homebrew tap, and updated Docker image available for the standalone CLI.
New bug bounty platform launched at bounties.cloudsmith.com for security researchers to submit vulnerability reports.
Sublime Security is an AI-powered email security platform that detects and remediates advanced threats like phishing and business email compromise.
Sublime email events now stream into CrowdStrike Falcon Next-Gen SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., and Sublime Actions run natively in Falcon Fusion SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbooks.
Adds Sublime Actions as native steps in Falcon Fusion SOAR playbooks, enabling message investigation and enrichment, hunt result retrieval, Rule and List management, and remediation without leaving Falcon.
Returns typed output from every Sublime Action in Fusion, allowing downstream playbook steps to branch on results without manual JSON parsing.
OpenShell is the safe, private runtime for autonomous AI agents.
OpenShell v0.0.96 adds supervisor middleware content guard, Kubernetes PVC storage class config, policy-first OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. image identity, workspace authorization, and OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. gateway tracing.
└──▷ GET THIS VERSION
$ git clone --branch v0.0.96 https://github.com/NVIDIA/OpenShell.git
# already have the repo? check out this version:$ git checkout v0.0.96
Adds supervisor middleware content guard example for filtering or inspecting sandbox traffic at the supervisor layer.
Supports configuring a custom storageClassName for workspace PVCs in Kubernetes deployments.
Introduces policy-first OCI image identity resolution in the sandbox, giving security policies priority in image evaluation.
Wires authorization checks into the workspace model, enabling access control enforcement at the workspace level.
Exports gateway traces over OTLP, enabling distributed tracing observability for gateway activity.
Huntress is a managed threat detection and response platform that helps MSPs and enterprises detect and respond to security threats.
Huntress API gains an endpoint to create IP-based allow/block rules for Managed ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. Unwanted Access.
New API endpoint lets you programmatically create IP address-based rules for Managed ITDR Unwanted Access, accepting a single IP, a CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. range, or a list of IPs in one call.
Trend Vision One is a unified cybersecurity platform that integrates extended detection and response (XDR) across endpoints, networks, email, and cloud environments.
Trend Vision One Container Security now supports Service Gateway as a connection method for Amazon ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. clusters.
└──▷ HOW TO FIND IT
Route ECS cluster traffic through a Service Gateway instead of a direct internet connection — useful for air-gapped or private-network environments.
📍In the console, go to Cloud Security → Container Security, open your Amazon ECS cluster connection settings, and select Service Gateway as the connection method.
1 more release in this issue
· 2026-07-27 → 2026-07-30
Container Protection for Amazon ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. 2.2.6 adds Service Gateway forward proxy support and CodePipeline deployment updates.
Supports using a Service Gateway as a forward proxy for Amazon ECS clusters.
Supports CodePipeline standard deployment updates for OriginalTaskDefArn.
Granular, Actionable Adversary Emulation for the Cloud
Adds new Azure attack technique to emulate AI Foundry API key exfiltration via local auth re-enablement.
└──▷ GET THIS VERSION
$ git clone --branch v2.35.0 https://github.com/DataDog/stratus-red-team.git
# already have the repo? check out this version:$ git checkout v2.35.0
└──▷ TRY IT
Emulate an attacker re-enabling local auth on an Azure AI Foundry account and exfiltrating its API keys — useful for validating detections on Azure Cognitive Services key-listing activity.
New Azure technique azure.persistence.exfiltrate-foundry-key: re-enables local (key-based) authentication on an Azure AI Foundry (Cognitive Services) account and retrieves API keys via ListKeys, emulating a Persistence/Credential Access attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!The azure.persistence.exfiltrate-foundry-key technique requires the ARM_SUBSCRIPTION_ID environment variable (not AZURE_SUBSCRIPTION_ID) due to an upgrade to the azurerm Terraform provider 4.80.0.
Cribl is an observability pipeline platform that helps organizations collect, process, route, and transform machine data from any source to any destination.
Cribl launches AI Observability app — unified search, cost tracking, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. detection, and trace investigation across all AI models and providers.
└──▷ HOW TO FIND IT
Surface PII or credential leakage in AI sessions by reviewing Sensitive Data Traces — useful during a security review or incident triage.
📍In Cribl.Cloud, open the AI Observability app › Security and Compliance Dashboard › Sensitive Data Traces, then filter by subcategory (PII, credentials, API keys) and by user or model to locate the exact trace or session where sensitive data appeared.
Track AI spend against budget targets to catch token overruns before they become a finance problem.
📍In Cribl.Cloud, open the AI Observability app › Goals and Monitors, create a new monitor targeting month-to-date token spend, and set the budget threshold for your team or model.
Investigate a model quality regression by jumping from a dashboard anomaly directly into the full prompt and response payloads for that session.
📍In Cribl.Cloud, open the AI Observability app › Sessions and Traces, filter the session list by model and time range, select the suspect session, and inspect the span timeline alongside full prompt, response, and tool-call payloads.
New Cribl app for AI Observability provides a single platform to search, investigate, and report on AI telemetry across models, tools, and environments.
Usage and Cost Dashboard surfaces spending trends, token consumption, top users and models, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. efficiency anti-patterns, and an activity heatmap.
Org View delivers a hierarchical roll-up of spend, tokens, and requests across the organization.
Goals and Monitors continuously evaluate live AI telemetry against user-defined targets such as month-to-date token spend vs. budget.
Security and Compliance Dashboard tracks sensitive data exposure rates, findings by type and user, tool-call audit trails, and content risk indicators.
+5 moreshow less
Sensitive Data Traces pinpoint exactly where PII, credentials, and API keys appear within a trace or session.
Sessions and Traces view provides end-to-end trace visibility with filterable session lists, span timelines, and full prompt, response, and tool-call payloads.
AI Insights offers a conversational AI agent for querying usage, cost, and security data across the org in plain language.
AI-generated briefs automatically surface anomalies and areas needing attention without requiring manual investigation.
Built on Cribl's AI Platform for Telemetry Lakehouse engine, enabling data collection, transformation, storage, and flexible analysis via search or dashboards.
Sumo Logic is a cloud-native platform that collects, analyzes, and visualizes machine data and logs for security, observability, and operational intelligence.
Sumo Logic adds new dashboards, FERs, and monitors across 18+ apps, plus a new Terraform resource for Lambda invoke actions.
Adds new and updated dashboards, field extraction rules (FERs), and monitors for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. 2012+ (JSON), Artifactory 7, Azure Audit, ChatGPT Compliance, Cisco Meraki, Cloudflare Enterprise Audit - Cloud SIEMCloud SIEMA Security Information and Event Management platform delivered as a hosted service, aggregating logs and alerts from across an environment to detect threats without requiring on-premises infrastructure., Heroku, Host and Process Metrics, Host Metrics Linux, LiteLLM, Microsoft Office 365, Windows 2012+ (JSON), Windows 7+2008 (Legacy), Windows CSMA, Windows Performance, Zscaler Internet Access, and Zscaler Private Access.
Migrates Azure Metrics collection from legacy ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-based collection to the latest Azure Metrics Source.
Adds new Terraform resource sumologic_lambda_invoke_action in SumoLogic Terraform Provider v3.2.9.
runZero is a continuous asset intelligence platform that discovers, inventories, and monitors all connected devices and software across networks in real-time.
runZero 5.1 adds compliance-friendly AI workflows, autonomous discovery, enhanced integration framework, ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. remediation handoffs, and improved Dragos OT enrichment.
Adds compliance-friendly AI workflows for querying and surfacing asset data insights.
Introduces autonomous discovery mode for automated, continuous attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. intelligence.
Enhanced integration framework with refined merge logic to accelerate custom integrations.
Streamlined remediation handoffs available directly inside runZero or via ITSM integration.
Improved Dragos integration enriches OT/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. asset context and reduces data silos.
+1 moreshow less
Connected AWS accounts now skip task processing for disabled AWS regions.
DNSFilter is a cloud-based DNS security platform that blocks malicious websites, filters unwanted content, and protects networks from cyber threats in real time.
DNSFilter 3.6.10 adds DNS PreCheck v2, Brave SafeSearch enforcement, redesigned SafeSearch controls, and AppAware Sites filter.
└──▷ HOW TO FIND IT
Enable SafeSearch enforcement across all supported search engines at once inside a Filtering Policy.
📍In the console, go to Filtering Policies › [select a policy] › Privacy tab › SafeSearch section, then click Enforce All to enable enforcement for Google, Bing, DuckDuckGo, Ecosia, Yandex, and Brave simultaneously.
Find unclassified domains in the Query Log to identify traffic that may need manual categorization or blocking.
📍In the console, go to Query Log, open the filter panel, and select Uncategorized from the category filter to show only queries DNSFilter has not yet classified.
Scope AppAware reporting to a specific site in a mixed Core/Pro environment to audit per-site application usage.
📍In the console, go to AppAware Reporting, open the filter bar, and select the desired site from the new Sites filter to view query data limited to that site.
Introduces DNS PreCheck v2 for Windows Roaming Client, maintaining policy enforcement even on networks that hijack or redirect DNS traffic.
Adds automatic tray process recovery so the system tray restarts itself if it stops unexpectedly, keeping status and controls available.
Adds Sites filter to AppAware Reporting, giving Core plan and mixed Core/Pro environments query data scoped to specific sites.
Supports SafeSearch enforcement on Brave browser in Filtering Policies, joining Google, Bing, DuckDuckGo, Ecosia, and Yandex.
Redesigns the SafeSearch policy editor section with decoupled enforcement toggles and a new Enforce All shortcut to enable every SafeSearch engine at once.
+2 moreshow less
Adds Uncategorized filter option to the DNS Query Log for surfacing unclassified queries; updates terminology from Blacklist/Whitelist to Block/Allow throughout.
Makes Collections and Users widgets on the MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Overview page clickable, linking directly to their respective management pages.
Auth0 is a cloud-based identity platform that provides authentication and authorization services, enabling developers to securely add login and access control to applications.
Auth0 adds AI agent identity, curated IP blocklists, org-scoped roles, cross-app access, and enterprise federation in a wave of new capabilities.
└──▷ TRY IT
Block all traffic from active TOR exit nodes and low-reputation IPs at the tenant level using curated Auth0 Threat Intel lists.
Find a specific user or application across your tenant instantly without navigating menus.
📍In the Auth0 Dashboard, press Cmd+K (or Ctrl+K), then type the user's email address or application name to search across Applications, APIs, Organizations, and Users in real time.
Adds Global Search (Beta) to the Command Palette (Cmd+K), enabling real-time tenant-wide search across Applications, APIs, Organizations, and Users by name, ID, email, or identifier with one-click ID copying.
Introduces Enterprise Connect (Beta), letting you federate existing SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. or OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authorization servers (including Okta) into Auth0 and layer on enterprise SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. user provisioning, and self-service B2B onboarding with Actions-based claim enrichment and connection lifecycle events.
Launches Curated Blocklists in Tenant ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. (GA), integrating dynamically updated Auth0 Threat Intel categories — auth0.low_reputation, auth0.tor, auth0.proxy, auth0.vpn, auth0.icloud_relay_proxy — into Network ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. rules via the auth0_managed matcher block in the Management API.
Introduces Agents as Principal (Early Access), giving AI agents a unique first-class identity with their own credentials, audit trail, and delegation chain encoding in tokens — separate from human users and shared clients.
Adds Token Vault Privileged Worker (Early Access), allowing background agents to authenticate via Private Key JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. or mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. and retrieve a specific user's third-party tokens (Gmail, Drive, Slack, etc.) from Token Vault without an active user session, with per-connection and per-scope credential pinning.
+5 moreshow less
Adds real-time Dashboard Search for Organization Members (Public Beta), supporting search by name, email, ID, and filtering by blocked status.
Publishes an Actions Reference Catalog at auth0.com/docs/actions/reference, documenting all trigger-specific Event and API objects available in custom Actions code.
Introduces Organization-Level Roles (Early Access), enabling creation, update, deletion, and assignment of roles scoped to individual organizations via the Management API or Dashboard, including pre-assignment during user invitations.
Adds Organization-to-Application Entitlement (Early Access), allowing per-org control over which applications organization members can access — enforced natively in Auth0 without custom Actions or metadata logic, opt-in and disabled by default.
Launches Cross App Access (XAA) for Resource Applications (Open Early Access), implementing an open standard for passing authorization across domains to support agent-to-app and app-to-app connections with centralized IT policy enforcement, supporting SAML and OIDC enterprise IdPs including Okta, with no code changes required.
Didit is a decentralized identity verification platform enabling secure digital identity management and verification for users and applications.
Didit adds Travel RuleTravel RuleA FATF requirement that cryptocurrency exchanges and other virtual asset service providers must collect and transmit sender and recipient identity data alongside transactions above a threshold amount. compliance, Console Copilot, Test mode sandbox, device integrity attestation, and expanded KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk./AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. capabilities.
└──▷ HOW TO FIND IT
Enable ongoing AML monitoring for a specific user directly from the Users table without navigating away.
📍In the Console, go to Users › find the user row › toggle the Monitoring column switch › review the cost estimate › confirm to enable monitoring.
Use the modular Flutter SDK variant to include only core verification without NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. or autodetection, reducing native footprint.
yaml
dependencies:
didit_sdk_core: ^4.5.3
Adds end-to-end Travel Rule compliance: encrypted IVMS 101 sender/recipient exchange, TRP messaging, secure email fallback, VASP directory, self-custody wallet ownership proof, and preset EU Transfer of Funds Regulation rules.
Introduces Didit Copilot in the Business Console — a resizable AI panel that builds workflows, applies filters, and navigates dialogs via natural language, voice input, or file attachment, with explicit confirmation gates for writes/deletes.
New applicant ID Verification Data Review step lets users confirm or correct extracted document fields before submission, with configurable outcomes by mismatch severity, MRZ-protected fields, and full correction history in session details.
Adds complete Test mode for sandbox applications: choose approved/declined/in-review scenarios, upload sample documents, enter any OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets., and assert the armed scenario via sandbox_scenario in the v3 decision payload — no external providers contacted.
New Device & Capture Integrity signals: Apple App Attest and Google Play Integrity attestation, frame injection detection with attack subtype reporting, virtual-camera risk flagging, and per-workflow policy actions (decline/review/record).
+5 moreshow less
Business Verification (KYB) adds EU VAT validation via VIES, configurable company-search field prefillprefillThe first phase of inference, where the model reads the whole prompt in parallel before producing its first token. It drives time-to-first-token; decode is the token-by-token phase after it./lock, local business document names in 103 countries, Document AI extraction results in KYB payloads and PDF reports, and file uploads up to 30 MB.
Ongoing AML monitoring can now be enabled or disabled per user or business record directly from the Users and Businesses tables, with cost preview before enabling, deduplication of monitored records, and transparent bulk-job skip reasons.
Transaction monitoring now supports native SDK submission with device intelligence attached, biometric one-selfie step-up remediation, sender/receiver field comparison in rules, and custom lists in text rules.
Native SDKs (versions 4.0.9–4.5.3) add transaction submission/retrieval with automatic user actions, wallet-ownership proof, Swift Package Manager support for iOS in React Native and Flutter, modular Flutter variants (didit_sdk_core, didit_sdk_autodetection, didit_sdk_nfc), and Arabic RTLRTLRegister Transfer Level, a hardware design abstraction describing how data moves between registers each clock cycle; cyber tools use it to analyze or synthesize digital circuits from HDL source. + Hebrew localization.
AI extraction expanded to Israeli and Kyrgyzstani documents, German health insurance cards, New Jersey IDs, Pennsylvania commercial driving licences, Australia's Larrakia Nation ID Card, and Northern Territory Proof of Identification Card.
Clerk is a user authentication and identity management platform that provides developers with pre-built UI components, APIs, and SDKs for sign-up, sign-in, and user management.
Clerk lets end-customer IT admins self-configure OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. connections directly from the OrganizationProfile UI.
└──▷ HOW TO FIND IT
Surface the Security tab to your customers' IT admins so they can set up their own OIDC SSO without involving your support team.
📍In your app, render <OrganizationProfile /> and direct IT admins to the Security tab to configure their OpenID Connect connection.
Enables organization IT admins to configure their own OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. SSO connections self-serve via the Security tab in <OrganizationProfile />.
Varonis is a data security platform that detects and stops insider threats, data breaches, and ransomware attacks across cloud and on-premises environments.
Varonis adds Search & Export APIs, IP-based tenant lockdown, VAST multi-tenant visibility, and expanded AI agent governance in Atlas.
New Search API provides programmatic access to Varonis data — events, identities, resources, permissions, memberships, and alerted events — to support investigations, workflow automation, and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents./SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. integrations.
Label lifecycle controls let administrators automatically remove or preserve Varonis-applied Microsoft Purview labels when the triggering conditions no longer apply.
Automatic label downgrade prevention compares existing Microsoft Purview labels against Varonis recommendations and only applies changes that result in stronger protection.
Segment information can now be included in Syslog messages, event publishing workflows, and MDDR escalation emails to improve alert routing and downstream correlation.
AI Investigation Sessions gain an Intent Timeline offering a chronological view of user intent, agent behavior, and tool activity within a session.
+2 moreshow less
Atlas runtime monitoring and governance extended to Devin CLI, Devin Desktop, Google Antigravity, Kiro, and OpenAI Codex coding agents.
AWS Bedrock activity can now be ingested into Atlas for AI usage visibility, auditability, and runtime policy enforcement.
Immuta is a data security platform that automates access control, privacy policy enforcement, and compliance monitoring across cloud data environments.
Immuta adds richer Connections controls, split request forms for data products, Redshift viewless data discovery, and new managed identity groups.
└──▷ HOW TO FIND IT
Force-delete a stuck UNHEALTHY Snowflake or Unity Catalog connection without waiting for it to recover.
📍In the Immuta console, navigate to Connections, locate the connection showing UNHEALTHY status, open its detail page, and select Force Delete.
Adds integration health states (ACTIVE, INACTIVE, UNHEALTHY) and per-connection settings directly within Connections for Databricks Unity Catalog and Snowflake.
Introduces per-object policy sync toggle to control whether Immuta pushes policies down to a given data object, with visibility into child object configuration and a Custom label when child settings differ from the parent.
Adds individual detail pages for leaf data objects, including a direct link to the corresponding data source.
Enables bulk or individual tag assignment and removal at the database or schema level, with tag inheritance flowing to all attached data sources.
Makes the behavior of the New tag configurable in App Settings (default: enabled for columns, disabled for data sources).
+7 moreshow less
Allows force-deletion of connections in an UNHEALTHY state.
Supports two distinct request forms per data product — one for data access requests and one for masking exception requests — each with independent questions and data use agreements.
Introduces three built-in, system-managed groups — All Agents, All Users, and All Identities — available for use in subscription and data policies.
Expands Unity Catalog tag ingestion to include foreign catalogs created via Lakehouse FederationLakehouse FederationA data architecture pattern that lets a single query engine read from multiple external data sources—databases, data lakes, warehouses—without moving or copying the data, reducing pipeline complexity for tools that need broad data access., using system.information_schema tag views as a fallback.
Improves Snowflake manual policy resync to synchronize both data policies and subscription policies in a single operation.
Delivers query performance improvements for Snowflake securables that have policies with advanced masking exceptions.
Treats Starburst (Trino) principal names as case-insensitive when matching to Immuta users and service accounts.
12 details in Everything
└──▷ BREAKING ON UPGRADE
!Immuta policy role names used to grant users access to Snowflake data sources will be renamed as part of the Snowflake integration architecture update rolling out beginning July 23, 2026; existing policy roles will be recreated under new names.
!Integration error banners for Snowflake validation failures will no longer be displayed; error details are now available only through the new Connections experience.
!When a data source is disabled, Immuta now revokes data owners' Immuta-managed grants in the data platform (behavior change release, on by default 8/1).
CISO Assistant is a one-stop-shop GRC platform for Risk Management, AppSec, Compliance & Audit, TPRM, BIA, Privacy, and Reporting. It supports 150+ global frameworks with automatic control mapping, including ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, and more.
$ git clone --branch v3.20.5 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.20.5
Adds 10 LPM/OIV required metrics definitions to the library, supporting regulated French operators of vital importance.
Adds translations for core cybersecurity metrics.
Expands in-platform preview support to additional evidence file types.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Old invalid Implementation Groups are pruned when updating a framework — existing mappings to invalid groups will be removed on framework update.
New /tangent command lets you branch into named side-conversations that inherit full conversation history, then return to the main thread without polluting it.
Browse your entire conversation tree with /tangent ls and jump to the root from any depth with /tangent root.
The /context command now shows a per-tool token breakdown so you can see exactly what is consuming your context windowcontext windowThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it..
Autonomous coding agent as an SDK, IDE extension, or CLI assistant.
Cline SDK v0.0.68 adds display-ready model names, ClinePass provider, UTF-8 PowerShell stdin, and Organization selector for ACP.
└──▷ GET THIS VERSION
$ git clone --branch sdk/sdk/v0.0.68 https://github.com/cline/cline.git
# already have the repo? check out this version:$ git checkout sdk/sdk/v0.0.68
Adds fetchClineRecommendedModels returning display-ready model names resolved through the model catalog (including Vercel and OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code. id aliases) under a shared timeout budget, so hosts no longer need to map ids to names themselves.
Adds Organization selector to ACP, letting users switch between personal account and org contexts without leaving the session.
Adds ClinePass as a selectable provider on ACP (id: cline-pass, Sign in with ClinePass).
On Windows, PowerShell commands now travel over UTF-8 stdin via getShellInvocation(), eliminating truncation from Windows command-line length limits and corruption of non-ASCII characters caused by active code page mismatches.
Exports finish-reason and auth-error helpers (describeAgentError and friends) for use by SDK consumers describing agent errors.
+1 moreshow less
Surfaces real upstream provider error messages (e.g. context-length exceeded) instead of raw Zod dumps or [object Object] when errors are forwarded through the Vercel AI Gateway.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!getShellArgs() is now deprecated and replaced by getShellInvocation(); callers relying on the old function should migrate to getShellInvocation().
Crush v0.88.0 adds .crushrc bash-based config, permissions deny, AWS Bedrock SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. re-auth, and new crushrc builtins for providers, models, MCPs, LSPs, and hooks.
└──▷ GET THIS VERSION
$ git clone --branch v0.88.0 https://github.com/charmbracelet/crush.git
# already have the repo? check out this version:$ git checkout v0.88.0
└──▷ TRY IT
Bootstrap a dotfiles-friendly crushrc that adds a local Ollama provider, auto-approves safe tools, and loads machine-specific overrides that stay out of git.
$ cat ~/.config/crush/crush.sh
# Add Ollama.
provider add ollama --type ollama --base-url "http://localhost:11434/v1"
# Register a model on Ollama.
model add ollama/llama3.3 --name "Llama 3.3" --context-window 128000
# Auto-approve read/write tools.
permissions allow view edit
# Load machine-specific secrets (kept in .gitignore).
source "$XDG_CONFIG_HOME/local-overrides.sh"
Apply different skill paths per hostname using crushrc conditionals and option reset.
$ cat >> ~/.config/crush/crush.sh <<'EOF'
if [[ $HOSTNAME == "workstation" ]]; then
option skill-path "$HOME/work-skills"
else
option reset skill-path
fi
EOF
Adds .crushrc bash-based configuration file, replacing JSON config with a scriptable shell format that supports conditionals, source includes, and environment variable expansion.
Adds permissions deny command in crushrc to explicitly hide specific tools from the agent.
Adds permissions allow command in crushrc to auto-approve tools without prompting.
Adds provider add and model add crushrc builtins for registering custom providers and models (e.g. local Ollama instances).
Adds mcp add / mcp remove crushrc builtins for managing MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers directly from the shell config.
+7 moreshow less
Adds lsp add / lsp remove crushrc builtins for managing LSPLSPLanguage Server Protocol, the standard way editors get code intelligence such as completions, go-to-definition and errors from a separate per-language server. Coding agents use it to understand code. servers from crushrc.
Adds hook add / hook remove crushrc builtins for managing agent hooks from crushrc.
Adds option reset command to wipe list-type shell config options back to defaults.
Exposes CRUSH_VERSION environment variable inside crushrc scripts for version-conditional configuration.
Adds automatic re-authentication UX for AWS Bedrock SSO token expiry, with automatic turn retry after re-auth.
Supports building and running Crush on illumos (OpenIndiana, OmniOS).
Applies top-level environment variables from crushrc on startup.
An MCP that lets AI tools securely connect to your infrastructure, write IaaS code, debug issues, and assist during incidents - without risking production stability. Built for security teams to approve and infrastructure teams to experience like magic.
Emisar v0.36.0 adds staged runbooks with typed inputs and parallel execution, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. 2026-07-28 routing, and 91 action packs with bounded diagnostics.
└──▷ GET THIS VERSION
$ git clone --branch v0.36.0 https://github.com/AndrewDryga/emisar.git
# already have the repo? check out this version:$ git checkout v0.36.0
Adds staged runbooks with typed inputs, sequential or parallel stage execution against selected runner groups, named step outputs, success condition testing, and explicit wait bounds.
Adds a single pre-execution approval gate that freezes the complete runbook execution plan before work begins.
Adds canonical JSON runbook definition format shared across the console, MCP, and execution pages, with attempt, output, wait, and terminal cause history.
Adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. discovery and JWKSJWKSA JSON Web Key Set, a published collection of cryptographic keys. Applications use it to find the public key needed to verify a token's signature. refresh under a shared bounded address policy that rechecks the actual response received; changing an issuer clears credentials tied to the old one.
Adds atomic SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. group patch application in wire order, with body bounding before authentication and automatic session and identity link retirement when a connection is disabled.
+4 moreshow less
Adds per-action account membership resolution for run and approval attribution, preventing cross-workspace profile leakage into the audit log.
Adopts MCP 2026-07-28 routing headers and dual-era endpoint on both the bridge and portal, including OAuth Client ID Metadata DocumentsClient ID Metadata DocumentsOAuth 2.0 documents hosted at a client's own URL that declare its identity and redirect URIs, letting authorization servers fetch and verify client metadata without manual registration..
Expands the action catalog to 91 packs and 1,386 actions, adding bounded diagnostics for GCP, Pure FlashArray, Terraform, Nomad, OIDC/JWKS, nftables, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., and Docker Compose.
Makes pack actions fail explicitly on missing source commands or HTTP error responses instead of reporting empty success through a downstream pipe.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!Disabling a SCIM connection now retires the sessions and pending identity links it vouched for — active sessions tied to a disabled SCIM connection will be terminated on upgrade.
!Pack actions now fail on missing source commands and HTTP error responses rather than returning an empty success — any automation that depended on silent empty-success behavior will begin receiving failures.
emisar runner v0.16.0 expands its infrastructure diagnostics catalog.
└──▷ GET THIS VERSION
$ git clone --branch runner-v0.16.0 https://github.com/AndrewDryga/emisar.git
# already have the repo? check out this version:$ git checkout runner-v0.16.0
vMLX 1.6.19 adds native-MTP diagnostics, model-owned sampling defaults, separate macOS Tahoe builds, and scoped sparse-cache blocks for MiniMax M3.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.19 https://github.com/jjang-ai/vmlx.git
# already have the repo? check out this version:$ git checkout v1.6.19
Adds native-MTP health and profiling telemetry exposing bounded cache-lifecycle, acceptance, and phase-timing metrics for Qwen MTP models.
Introduces model-owned generation defaults: temperature, Top P, Top K, repetition penalty, and output limits now hydrate from the selected model bundle in new and restored chats.
Ollama requests now preserve an explicitly supplied top_k value, including 0, through request translation.
Automatic prompt limits are now derived from the actually loaded model's configuration, bounded by its declared context ceiling and current memory budget.
MiniMax M3 native sparse-cache blocks are scoped to the prompt-prefillprefillThe first phase of inference, where the model reads the whole prompt in parallel before producing its first token. It drives time-to-first-token; decode is the token-by-token phase after it. shape, preventing numerically incorrect Lightning Indexer state restoration across mismatched prefill shapes.
+7 moreshow less
Cache namespaces for looped-transformer bundles now include the effective repeated-layer layout, preventing cross-incompatible-loop-count cache reuse.
Compatible Nanbeige looped-transformer JANG bundles now validate loop count, effective cache-slot count, and runtime metadata before generation, rejecting inconsistent bundles.
MiniMax M2-family automatic cache storage defaults to the q8 correctness-first policy.
Persistent cache payload encoding is moved off the inference-completion path, reducing synchronous CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. work at end of request.
KaTeX rendering gains improved disambiguation of literal currency symbols from inline math and unclosed dollar delimiters.
New settings and compatibility messages are localized across English, Spanish, Japanese, Korean, and Chinese interfaces.
Separate Apple-silicon downloads are now provided for macOS Tahoe and Sequoia-compatible systems.
AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 19 tools.
OpenOSINT v2.25.0 adds global HTTP/SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. upstream-proxy support and cloud billing OAuth for web-facing tools.
└──▷ GET THIS VERSION
$ git clone --branch v2.25.0 https://github.com/OpenOSINT/OpenOSINT.git
# already have the repo? check out this version:$ git checkout v2.25.0
Adds global upstream-proxy support (HTTP and SOCKS5) for all web-facing tools.
Introduces cloud billing OAuth integration and associated tooling.
THE CYBER TOOLCHAIN